Marinated updates for docker compose and APT hosts: marinade applies a release only after it has aged N days, bestbefore scans the running images for CVEs
